Operational teams running industrial systems rely on remote access devices to do their jobs and rarely think about the non-technical and non-commercial considerations when buying. But recent history is telling us that where the device—and even components within the device—come from matters much more than we recognize.
A supply chain attack is a category of cybersecurity attack where access is gained by targeting upstream elements in the supply chain. A layperson purchasing a device—perhaps to commission a piece of equipment over the weekend—may think that risk isn’t significant enough to influence the buying decision, but it is.
Supply chain attacks are extremely popular for attackers because, by infiltrating one supplier, they can gain access to many end users. For example, Stuxnet was an effective supply chain attack that targeted PLCs used in a uranium enrichment program. NotPetya, which caused an estimated 10 billion USD in damage to organizations including Merck and Saint-Gobain, was distributed through tax preparation software. Most recently, SUNBURST gave back-door access to up to 18,000 organizations and was distributed through SolarWinds software. This has occurred many times, and will continue because of the payoff for the attacker.
The idea of a supply chain attack targeting ICS through a remote access device isn’t just theoretical—it has happened before. In 2014, Dragonfly malware infected many organizations and was distributed through Ewon’s Talk2M application setup packages, which is software used to provide VPN access to ICS equipment. The SANS Institute provided a paper on the attack and its impacts, which you can read here.
So, going back to the layperson purchasing a device so they can commission some equipment—what should they do?
In situations where you aren’t—and can’t be—an expert, it’s wise to look at what experts are doing. In the case of security, one of these experts would be the U.S. Department of Defense. They plainly prohibit purchasing and use of devices, or contracting with providers who use devices, from certain foreign manufacturers because of risks in the supply chain. One DoD memo from July 2020 outlines this practice, and can be publicly viewed here. A named company of significance is Huawei Technologies Company (and its subsidiaries and affiliates), because of the broad use of their chips—including in remote access devices, such as Tosibox.
So, one takeaway for the layperson here may be to buy domestic whenever possible. It should be noted that buying domestically manufactured products, and products that were designed with deep layers of security, is not done easily and usually requires a pricing premium, but is undoubtedly worth the cost to the user—especially for remote access to industrial systems.
Beyond supply chain risks, there are many technical and organizational considerations when implementing remote access. I explored these within a work group with The Organization for Machine Automation and Control (OMAC), which then published a Practical Guide for Remote Access to Plant Equipment that I’d recommend reading.
The views expressed here are the author’s own. This article is a product of the International Society of Automation (ISA) Smart Manufacturing & IIoT Division. If you are an ISA member who is interested in joining this division, please log in to your account and visit this page.